The Dirty Pipe Vulnerability

An article by Max Kellermann about Dirty Pipe — a logical bug in the memory subsystem that allows writing to read-only files. The provided proof-of-concept works starting from Linux kernel version 5.8 released in August 2020.

The exploit makes the kernel merge a page cache entry belonging to a read-only file with another entry belonging to a pipe and thus writable by the user. This allows overwriting the in-memory contents of the read-only file.

Extending the proof-of-concept provided by Max Kellermann, Blasty has published an exploit for overwriting the contents of a SUID binary and getting root privileges.

Update: Another exploit. This one overwrites /etc/password. By Arinerron.